Cisco ASA 5506-X Manual de usuario

Cisco Systems, Inc.

www.cisco.com

Cisco has more than 200 offices worldwide.

Addresses, phone numbers, and fax numbers

are listed on the Cisco website at

www.cisco.com/go/offices.

Cisco ASA Series Firewall CLI

Configuration Guide

Software Version 9.3

For the ASA 5506-X, ASA 5512-X, ASA 5515-X, ASA 5525-X, ASA 5545-X, ASA

5555-X, ASA 5585-X, ASA Services Module, and the

Adaptive Security Virtual Appliance

Released: July 24, 2014

Updated: February 18, 2015

Text Part Number: N/A, Online only

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL

STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT

WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT

SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE

OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH

ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT

LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF

DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,

WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO

OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this

URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership

relationship between Cisco and any other company. (1110R)

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display

output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in

illustrative content is unintentional and coincidental.

Cisco ASA Series Firewall CLI Configuration Guide

iii

Cisco ASA Series Firewall CLI Configuration Guide

About This Guide

•Document Objectives, page iii

•Related Documentation, page iii

•Conventions, page iii

•Obtaining Documentation and Submitting a Service Request, page iv

Document Objectives

The purpose of this guide is to help you configure the firewall features for Cisco ASA series using the

command-line interface. This guide does not cover every feature, but describes only the most common

configuration scenarios.

You can also configure and monitor the ASA by using the Adaptive Security Device Manager (ASDM),

a web-based GUI application. ASDM includes configuration wizards to guide you through some

common configuration scenarios, and online help for less common scenarios.

Throughout this guide, the term “ASA” applies generically to supported models, unless specified

otherwise.

Related Documentation

For more information, see Navigating the Cisco ASA Series Documentation at

http://www.cisco.com/go/asadocs.

Conventions

This document uses the following conventions:

Convention Indication

bold font Commands and keywords and user-entered text appear in bold font.

italic font Document titles, new or emphasized terms, and arguments for which you supply

values are in italic font.

[ ] Elements in square brackets are optional.

Cisco ASA Series Firewall CLI Configuration Guide

Obtaining Documentation and Submitting a Service Request

Note Means reader take note.

Tip Means the following information will help you solve a problem.

Caution Means reader be careful. In this situation, you might perform an action that could result in equipment

damage or loss of data.

Obtaining Documentation and Submitting a Service Request

For information on obtaining documentation, using the Cisco Bug Search Tool (BST), submitting a

service request, and gathering additional information, see What’s New in Cisco Product Documentation

at: http://www.cisco.com/c/en/us/td/docs/general/whatsnew/whatsnew.html.

Subscribe to What’s New in Cisco Product Documentation, which lists all new and revised

Cisco technical documentation as an RSS feed and delivers content directly to your desktop using a

reader application. The RSS feeds are a free service.

{x | y | z } Required alternative keywords are grouped in braces and separated by

vertical bars.

[ x | y | z ] Optional alternative keywords are grouped in brackets and separated by

vertical bars.

string A nonquoted set of characters. Do not use quotation marks around the string or

the string will include the quotation marks.

courier font Terminal sessions and information the system displays appear in courier font.

courier bold font Commands and keywords and user-entered text appear in bold courier font.

courier italic font Arguments for which you supply values are in courier italic font.

< > Nonprinting characters such as passwords are in angle brackets.

[ ] Default responses to system prompts are in square brackets.

!, # An exclamation point (!) or a pound sign (#) at the beginning of a line of code

indicates a comment line.

ART

Service Policies and Access Control

CHAPTER

1-1

Cisco ASA Series Firewall CLI Configuration Guide

Service Policy Using the Modular Policy

Framework

Released: July 24, 2014

Updated: February 18, 2015

Service policies using Modular Policy Framework provide a consistent and flexible way to configure

ASA features. For example, you can use a service policy to create a timeout configuration that is specific

to a particular TCP application, as opposed to one that applies to all TCP applications. A service policy

consists of multiple actions or rules applied to an interface or applied globally.

•About Service Policies, page 1-1

•Guidelines for Service Policies, page 1-8

•Defaults for Service Policies, page 1-9

•Configure Service Policies, page 1-11

•Monitoring Service Policies, page 1-19

•Examples for Service Policies (Modular Policy Framework), page 1-19

•History for Service Policies, page 1-22

About Service Policies

The following topics describe how service policies work.

•The Components of a Service Policy, page 1-2

•Features Configured with Service Policies, page 1-4

•Feature Directionality, page 1-4

•Feature Matching Within a Service Policy, page 1-5

•Order in Which Multiple Feature Actions are Applied, page 1-6

•Incompatibility of Certain Feature Actions, page 1-7

•Feature Matching for Multiple Service Policies, page 1-8

1-2

Cisco ASA Series Firewall CLI Configuration Guide

Chapter 1 Service Policy Using the Modular Policy Framework

About Service Policies

The Components of a Service Policy

The point of service policies is to apply advanced services to the traffic you are allowing. Any traffic

permitted by access rules can have service policies applied, and thus receive special processing, such as

being redirected to a service module or having application inspection applied.

You can have these types of service policy:

•One global policy that gets applied to all interfaces.

•One service policy applied per interface. The policy can be a mix of classes for traffic going through

the device and management traffic directed at the ASA interface rather than going through it,

Each service policy is composed of the following elements:

1. Service policy map, which is the ordered set of rules, and is named on the service-policy command.

In ASDM, the policy map is represented as a folder on the Service Policy Rules page.

2. Rules, each rule being a class command within the service policy map and the commands associated

with the class command. In ASDM, each rule is shown on a separate row, and the name of the rule

is the class name.

a. The class command defines the traffic matching criteria for the rule.

b. The commands associated with class, such as inspect, set connection timeout, and so forth,

define the services and constraints to apply to matching traffic. Note that inspect commands can

point to inspection policy maps, which define actions to apply to inspected traffic. Keep in mind

that inspection policy maps are not the same as service policy maps.

The following example compares how service policies appear in the CLI with how they appear in ASDM.

Note that there is not a one-to-one mapping between the figure call-outs and lines in the CLI.

The following CLI is generated by the rules shown in the figure above.

: Access lists used in class maps.

: In ASDM, these map to call-out 3, from the Match to the Time fields.

access-list inside_mpc line 1 extended permit tcp 10.100.10.0 255.255.255.0 any eq sip

access-list inside_mpc_1 line 1 extended deny udp host 10.1.1.15 any eq snmp

access-list inside_mpc_1 line 2 extended permit udp 10.1.1.0 255.255.255.0 any eq snmp

access-list inside_mpc_2 line 1 extended permit icmp any any

: SNMP map for SNMP inspection. Denies all by v3.

: In ASDM, this maps to call-out 4, rule actions, for the class-inside policy.

snmp-map snmp-v3only

deny version 1

deny version 2

deny version 2c

: Inspection policy map to define SIP behavior.

: The sip-high inspection policy map must be referred to by an inspect sip command

1-3

Cisco ASA Series Firewall CLI Configuration Guide

Chapter 1 Service Policy Using the Modular Policy Framework

About Service Policies

: in the service policy map.

: In ASDM, this maps to call-out 4, rule actions, for the sip-class-inside policy.

policy-map type inspect sip sip-high

parameters

rtp-conformance enforce-payloadtype

no traffic-non-sip

software-version action mask log

uri-non-sip action mask log

state-checking action drop-connection log

max-forwards-validation action drop log

strict-header-validation action drop log

: Class map to define traffic matching for the inside-class rule.

: In ASDM, this maps to call-out 3, from the Match to the Time fields.

class-map inside-class

match access-list inside_mpc_1

: Class map to define traffic matching for the sip-class-inside rule.

: In ASDM, this maps to call-out 3, from the Match to the Time fields.

class-map sip-class-inside

match access-list inside_mpc

: Class map to define traffic matching for the inside-class1 rule.

: In ASDM, this maps to call-out 3, from the Match to the Time fields.

class-map inside-class1

match access-list inside_mpc_2

: Policy map that actually defines the service policy rule set named test-inside-policy.

: In ASDM, this corresponds to the folder at call-out 1.

policy-map test-inside-policy

: First rule in test-inside-policy, named sip-class-inside. Inspects SIP traffic.

: The sip-class-inside rule applies the sip-high inspection policy map to SIP inspection.

: In ASDM, each rule corresponds to call-out 2.

class sip-class-inside

inspect sip sip-high

: Second rule, inside-class. Applies SNMP inspection using an SNMP map.

class inside-class

inspect snmp snmp-v3only

: Third rule, inside-class1. Applies ICMP inspection.

class inside-class1

inspect icmp

: Fourth rule, class-default. Applies connection settings and enables user statistics.

class class-default

set connection timeout embryonic 0:00:30 half-closed 0:10:00 idle 1:00:00

reset dcd 0:15:00 5

user-statistics accounting

: The service-policy command applies the policy map rule set to the inside interface.

: This command activates the policies.

service-policy test-inside-policy interface inside

1-4

Cisco ASA Series Firewall CLI Configuration Guide

Chapter 1 Service Policy Using the Modular Policy Framework

About Service Policies

Features Configured with Service Policies

The following table lists the features you configure using service policies.

Feature Directionality

Actions are applied to traffic bidirectionally or unidirectionally depending on the feature. For features

that are applied bidirectionally, all traffic that enters or exits the interface to which you apply the policy

map is affected if the traffic matches the class map for both directions.

Table 1-1 Features Configured with Service Policies

Feature

For Through

Traffic?

For Management

Traffic? See:

Application inspection (multiple

types)

All except

RADIUS

accounting

RADIUS

accounting only

•Chapter 6, “Getting Started with Application

Layer Protocol Inspection.”

•Chapter 7, “Inspection of Basic Internet

Protocols.”

•Chapter 8, “Inspection for Voice and Video

Protocols.”

•Chapter 9, “Inspection of Database and Directory

Protocols.”

•Chapter 10, “Inspection for Management

Application Protocols.”

•Chapter 14, “ASA and Cisco Cloud Web

Security.”

ASA IPS Yes No Chapter 18, “ASA IPS Module.”

ASA CX Yes No Chapter 17, “ASA CX Module.”

ASA FirePOWER (ASA SFR) Yes No Chapter 16, “ASA FirePOWER (SFR) Module.”

NetFlow Secure Event Logging

filtering

Ye s Ye s See the general operations configuration guide.

QoS input and output policing Yes No Chapter 12, “Quality of Service.”

QoS standard priority queue Yes No Chapter 12, “Quality of Service.”

TCP and UDP connection limits

and timeouts, and TCP sequence

number randomization

Ye s Ye s Chapter 11, “Connection Settings.”

TCP normalization Yes No Chapter 11, “Connection Settings.”

TCP state bypass Yes No Chapter 11, “Connection Settings.”

User statistics for Identity

Firewall

Ye s Ye s See the user-statistics command in the command

reference.

Otros manuales para ASA 5506-X

Este manual sirve para los siguientes modelos

Tabla de contenidos

Otros manuales de Cortafuegos de Cisco

Cisco

Cisco RV110W Manual de usuario

Cisco

Cisco Small Business RV215W Manual de usuario

Cisco

Cisco PIX 501 Manual

Cisco

Cisco ASA 5555-X Manual de usuario

Cisco

Cisco 881W - Integrated Services Router Wireless Manual de instrucciones

Cisco

Cisco RV110W Manual de usuario

Cisco

Cisco IPS-4255-K9 - Intrusion Protection Sys 4255 Manual de usuario

Cisco

Cisco Firepower 1100 Series Manual

Cisco

Cisco 5505 - ASA Firewall Edition Bundle Manual de usuario

Cisco

Cisco IronPort M1070 Manual de usuario

Cisco

Cisco Firepower 4100 Series Manual de instalación y operación

Cisco

Cisco M690 Manual de usuario

Cisco

Cisco Firepower 1100 Manual de usuario

Cisco

Cisco Small Business RV220W Manual de usuario

Cisco

Cisco 5510 - ASA SSL / IPsec VPN Edition Manual de usuario

Cisco

Cisco PIX-515E Manual de usuario

Cisco

Cisco PIX 506E - Security Appliance Manual de usuario

Cisco

Cisco Firepower 2100 Series Manual de usuario

Cisco

Cisco Firepower 4110 Manual de usuario

Cisco

Cisco M195 Manual

Cisco

Cisco PIX 501 Manual de usuario

Cisco

Cisco ASA 5506-X Instrucciones de instalación

Cisco

Cisco RV110W Manual de instrucciones

Cisco

Cisco Firepower 3500 Documento técnico

Manuales populares de Cortafuegos de otras marcas

Fortinet

Fortinet FortiGate Voice Series Manual de usuario

ADTRAN

ADTRAN NetVanta 2300 Manual de usuario

SecureLogix

SecureLogix ETM System Manual de usuario

NETGEAR

NETGEAR ProSafe FVX538 Manual de usuario

Lanner

Lanner FW-8877 Manual de usuario

Huawei

Huawei USG6000 Series Manual de instalación y operación

H3C

H3C SecPath F5000-AI-15 Manual de usuario

Nexcom

Nexcom DNA 1150 Manual de usuario

Fortinet

Fortinet FortiGate-60 series Manual de usuario

Draytek

Draytek Vigor2860 Series Manual de usuario

Lanner electronics

Lanner electronics FW-7650 Series Manual de usuario

Swisscom

Swisscom Internet Backup Manual de usuario

SonicWALL

SonicWALL NSa 5700 Manual de usuario

DPtech

DPtech FW1000 SERIES Manual de usuario

FEITIAN

FEITIAN MultiPass FIDO Manual de usuario

EBLOCKER

EBLOCKER PRO Manual de usuario

GTA

GTA GB-200 Manual de usuario

Trend Micro

Trend Micro Deep Edge Manual de usuario